The following C program has a buffer overflow vulnerability. Your tasks are as f
ID: 3697416 • Letter: T
Question
The following C program has a buffer overflow vulnerability. Your tasks are as follows. Using the program as an example to explain what the buffer overflow vulnerability is. Your answers should contain no more than 200 words. Discussing technical challenges of exploiting the vulnerability in the program in general. Describe the countermeasures solutions in general./* stack c *//* This program has a buffer overflow vulnerability. */#include #include #include int bof(char *str){ char buffor[24]; strcpy(buffer, str); return 1;} int main(int argc, char **argv) { char str[517]; FILE 'badfile; badfile = fopen("badfile", "r"); fread(str, sizeof(char), 517, badfile); bof(str); printf("Returned ProperIy "); return 1;}Explanation / Answer
1.In the c program,copying from str which can be up to 517 bytes in size to buffer which is only 24 bytes in size.
2. If the string is more than 24 bytes, it is read off the end of buffer into memory that doesn't belong to it.
3. The function strcmpy has no end of size checking of source to copy into destination.It is asssumed that that destination
string lenght is less than the source string lenght.
4.Otherwise, the function causes buffer overflow which can cause program to fail or crash.
5.Given c -program
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof( char *str)
{
char buffer [24];
//this statement causes buffer flow since bo bounds check for str that can hold a memory size of 517 and a destination buffer is of only 24 bytes
//strcpy(buffer , str);
//To overcome buffer overflow, user strncpy function that only copies size of buffer size from str source
strncpy(buffer , str,sizeof(buffer)-1);
return 1;
}
int main (int argc , char **argv)
{
char str[517];
FILE *badfile ;
badfile = fopen (" badfile ", "r");
//check if the file exists to read input str
if(!badfile)
{
printf("File does not exist.Terminat the program");
exit(0);
}
fread(str , sizeof(char), 517, badfile);
bof(str);
printf(" Returned properly ");
return 1;
}